CVE-2026-82268CWE-918ssrf

CVE-2026-82268

High · published August 29, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00351 · 27.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-29T00:20Z
References (5)
https://github.com/QwenLM/Qwen-Agent · [email protected]https://github.com/QwenLM/Qwen-Agent/blob/31a4d36d123688581a9e9744427272b33ce940e0/qwen_agent/tools/simple_doc_parser.py · [email protected]https://github.com/QwenLM/Qwen-Agent/issues/913 · [email protected]https://www.vulncheck.com/advisories/qwen-agent-server-side-request-forgery-via-caller-supplied-document-url · [email protected]https://github.com/QwenLM/Qwen-Agent/issues/913 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL
    cvelistv5